2026

Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more

Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out o

Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap grow

UnoPim versions before 2.0.1 and 2.1.1 trust all connecting clients as proxies and honor the X-Forwarded-Host header wit

Missing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and earlier allows an authe

Missing authorization in the attachment history API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated

Missing authorization in the data source settings API in Devolutions Server 2026.3.5.0 and earlier allows an authenticat

ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the language update function

ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the admin video edit functio

Pardus Parental Control before 0.7.0 contains an incorrect authorization vulnerability in the polkit policy that allows

CTranslate2 before 4.8.1 contains an out-of-bounds heap read vulnerability in the binary model loader when deserializing

NVIDIA ConnectX and Bluefield contain a vulnerability in a control register, where a user with VF access could cause imp

An improper authorization vulnerability exists in the handling of sub-workflow tasks. An authenticated user who does not

An authentication bypass vulnerability exists in the protection of Actuator endpoints. The application determines whethe

A missing authorization vulnerability exists in the `query-dynamic-sub-workflows` API of Apache DolphinScheduler. The AP

An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a

An improper authorization check in Apache DolphinScheduler allows an authenticated user to use the batch-copy and batch-

Information disclosure in the Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157,

PyPy before versions 3.11.16 and 3.12.14 contains a use-after-free vulnerability in the pyexpat module's ExternalEntityP

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Cleartext Transmission of Sen

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an URL Redirection to Untrusted

Denial-of-service in the Storage: StorageManager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbi

Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 157.

Spoofing issue in the Networking: HTTP component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Th

Site isolation issue in the Panning and Zooming component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbir

Other issue in the JavaScript: WebAssembly component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.

Denial-of-service in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunder

Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 1

Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.

Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.

Denial-of-service in the Networking component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.

JIT miscompilation in the JavaScript Engine component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.

Uninitialized memory in the Audio/Video component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, T

Information disclosure in the Networking: JAR component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Cross-Site Request Forgery (C

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to 5.36, contains a Downl

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to 5.36, contains an Impr

The /datasources/unauth-datasource endpoint does not properly enforce data source authorization. An authenticated user c

Sliver C2 framework version 1.7.7 and earlier contains an unhandled panic vulnerability in the operator gRPC handler tha

X11 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service

Frame protocol metadissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service

USB HID protocol dissector infinite loop and memory leak in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service

Toshiba file parser crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service

Profile import crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service and possible code execution

TIFF protocol dissector infinite loop in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service

RF4CE protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service

IEEE 802.11 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service

Catapult DCT2000 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service

IEEE C37.118 Synchrophasor protocol dissector memory leak in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service

Microsoft Network Monitor file parser large loop in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service